-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2007.0103                  AUSCERT Advisory

                             [Win][UNIX/Linux]
   Thunderbird 2.0.0.9 has been released fixing arbitrary code execution
                             16 November 2007
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              Thunderbird 
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact:               Execute Arbitrary Code/Commands
                      Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-4841 CVE-2007-5339 CVE-2007-5340
Member content until: Friday, December 14 2007

Ref:                  ESB-2007.0814

Original Bulletin:    
http://www.mozilla.org/projects/security/known-vulnerabilities.html#thunderbird2.0.0.9


OVERVIEW:

        Thunderbird 2.0.0.9 has been released fixing multiple security 
        vulnerabilities potentially allowing arbitrary code execution. [1][2]

                
IMPACT: 

        MFSA-2007-36 [1] allows for URIs with encoding to be passed triggering 
        a condition in the Windows shell which may allow execution of 
        arbitrary code. This vulnerability is described in CVE-2007-4841 [3]

        MFSA-2007-29 may allow for execution of arbitrary code via multiple 
        exploitable conditions. CVE-2007-5339 [4] identifies vulnerabilities
        in the browser engine. CVE-2007-5340 [5] identifies vulnerabilities 
        in the javascript engine.


MITIGATION:

        Users should upgrade to version 2.0.0.9 of the Thunderbird email 
        client. [6]

        The default configuration for Thunderbird disables javascript in 
        email, decreasing the likelihood that the vulnerability described
        in this advisory could be exploited.


REFERENCES:

        [1] Mozilla Foundation Security Advisory 2007-36
            http://www.mozilla.org/security/announce/2007/mfsa2007-36.html

        [2] Mozilla Foundation Security Advisory 2007-29
            http://www.mozilla.org/security/announce/2007/mfsa2007-29.html

        [3] CVE-2007-4841 - Invalid URI encoding may allow code execution
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4841

        [4] CVE-2007-5339 - Multiple remotely exploitable browser engine 
            vulnerabilities.
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5339

        [5] CVE-2007-5340 - Multiple remotely exploitable javascript engine 
            vulnerabilities.
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5340

        [6] Thunderbird latest version:
            http://www.mozilla.com/en-Us/thunderbird/all.html


AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRz00sih9+71yA2DNAQJLMAP/RPRVDPxPCcfKzPhtL9MG0kjYrlTrqf/4
xouxmKktMNMHAu91XPW234N5oAhGi+YQm+pzHIy2qrWNxZDoCd00rI/jDwTuSpNS
uenjtVYu0jScDDoTUxNb7Y0aSS6sWIOUsFp05kAEA4wHSZPCXwt4ZXhfnSzpQ6i+
tJDXu85/V6A=
=7fny
-----END PGP SIGNATURE-----